Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-7klql.tmp\is-spoc6.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-tdvc4.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-1690m.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-8jfur.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-pa57h.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-q35et.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-dtsml.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-aih68.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-57dsq.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-gfkgj.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-t0hqv.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-65iph.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-4lfnl.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-t4fuh.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-k09e5.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-8qi0u.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-u38jb.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-vcnbs.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-dvcm8.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-59uo2.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-9eh56.tmp
- %ProgramFiles(x86)%\nres\nres917.exe
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-gee8b.tmp
- %ProgramFiles(x86)%\nres\unins000.dat
- %ProgramFiles(x86)%\nres\is-374v0.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-303ed.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-vn3iu.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-if23g.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-9e2f2.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-oapck.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-cq0uc.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-mpt8o.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-dicv6.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-gis8r.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-u4fj1.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-p50ph.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-4p94l.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-pr8tb.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-a7jm4.tmp
- %ProgramFiles(x86)%\nres\tweaks\is-db36o.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-q8t4n.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-hj0v3.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-vbl0u.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-77cv4.tmp
- %ProgramFiles(x86)%\nres\themes\is-bvrtl.tmp
- %ProgramFiles(x86)%\nres\themes\is-m7pvm.tmp
- %ProgramFiles(x86)%\nres\themes\is-aml6d.tmp
- %ProgramFiles(x86)%\nres\themes\is-bmsnd.tmp
- %ProgramFiles(x86)%\nres\is-de0sl.tmp
- %ProgramFiles(x86)%\nres\is-j5vc5.tmp
- %ProgramFiles(x86)%\nres\is-3q0r3.tmp
- %ProgramFiles(x86)%\nres\is-ja8rb.tmp
- %ProgramFiles(x86)%\nres\is-sh1e1.tmp
- %ProgramFiles(x86)%\nres\themes\is-vfe5b.tmp
- %ProgramFiles(x86)%\nres\is-u2tqk.tmp
- %ProgramFiles(x86)%\nres\is-9pf1t.tmp
- %ProgramFiles(x86)%\nres\is-4g1so.tmp
- %ProgramFiles(x86)%\nres\is-im45c.tmp
- %TEMP%\is-17r1b.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-17r1b.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-17r1b.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-17r1b.tmp\_isetup\_setup64.tmp
- %TEMP%\is-17r1b.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\nres\is-e7jd0.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-qb17c.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-a5o1g.tmp
- %ProgramFiles(x86)%\nres\themes\is-qquuv.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-3hm17.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-ns1u7.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-ba90r.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-q64l7.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\funny\is-2piui.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-kvn7s.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-4m110.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-08val.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-batp8.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-j01p1.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-sh1rs.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-eaif1.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-9g9ct.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-hbiru.tmp
- %ProgramFiles(x86)%\nres\themes\built-in\is-5ednq.tmp
- %ProgramFiles(x86)%\nres\themes\is-06g3k.tmp
- %ProgramFiles(x86)%\nres\themes\is-h1bqe.tmp
- %ProgramFiles(x86)%\nres\themes\is-bjnor.tmp
- %ProgramFiles(x86)%\nres\themes\is-iu85r.tmp
- %TEMP%\license.txt
Перемещает следующие файлы
- %ProgramFiles(x86)%\nres\is-im45c.tmp в %ProgramFiles(x86)%\nres\unins000.exe
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-1690m.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunshine.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-8jfur.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunglasses.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-pa57h.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunflower.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-q35et.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunbeach.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-dtsml.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sun-smile.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-aih68.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\seadawn.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-57dsq.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\seabot.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-59uo2.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\rain.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-gfkgj.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\timothy.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-65iph.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\niceday.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-4lfnl.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\mountains.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-t4fuh.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\midnight.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-k09e5.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\happynewyear.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-8qi0u.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\firework.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-u38jb.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\colorstars.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-t0hqv.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\seaandsunglasses.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-4m110.tmp в %ProgramFiles(x86)%\nres\themes\built-in\square.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-hj0v3.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\tulips.themeb
- %ProgramFiles(x86)%\nres\tweaks\is-vn3iu.tmp в %ProgramFiles(x86)%\nres\tweaks\tweaksdb.json
- %ProgramFiles(x86)%\nres\tweaks\is-if23g.tmp в %ProgramFiles(x86)%\nres\tweaks\tweaksdb.ini
- %ProgramFiles(x86)%\nres\tweaks\is-9e2f2.tmp в %ProgramFiles(x86)%\nres\tweaks\nc010cortana.png
- %ProgramFiles(x86)%\nres\tweaks\is-oapck.tmp в %ProgramFiles(x86)%\nres\tweaks\nc009powertweaks.png
- %ProgramFiles(x86)%\nres\tweaks\is-cq0uc.tmp в %ProgramFiles(x86)%\nres\tweaks\nc008lockscreen.png
- %ProgramFiles(x86)%\nres\tweaks\is-dicv6.tmp в %ProgramFiles(x86)%\nres\tweaks\nc007misctweaks.png
- %ProgramFiles(x86)%\nres\tweaks\is-9eh56.tmp в %ProgramFiles(x86)%\nres\tweaks\nc006browsertweaks.png
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-vcnbs.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\colorfire.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-tdvc4.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\sunup.themeb
- %ProgramFiles(x86)%\nres\tweaks\is-p50ph.tmp в %ProgramFiles(x86)%\nres\tweaks\nc004security.png
- %ProgramFiles(x86)%\nres\tweaks\is-4p94l.tmp в %ProgramFiles(x86)%\nres\tweaks\nc003privacy.png
- %ProgramFiles(x86)%\nres\tweaks\is-pr8tb.tmp в %ProgramFiles(x86)%\nres\tweaks\nc002speedup.png
- %ProgramFiles(x86)%\nres\tweaks\is-a7jm4.tmp в %ProgramFiles(x86)%\nres\tweaks\nc002adsclean.png
- %ProgramFiles(x86)%\nres\tweaks\is-db36o.tmp в %ProgramFiles(x86)%\nres\tweaks\nc001winantispy.png
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-q8t4n.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\water.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-gee8b.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\vulkan.themeb
- %ProgramFiles(x86)%\nres\tweaks\is-u4fj1.tmp в %ProgramFiles(x86)%\nres\tweaks\nc005defender.png
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-vbl0u.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\valley.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-dvcm8.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\clock.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-mpt8o.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\christmasdog.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-77cv4.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\christmascandle.themeb
- %ProgramFiles(x86)%\nres\is-j5vc5.tmp в %ProgramFiles(x86)%\nres\software.png
- %ProgramFiles(x86)%\nres\themes\is-bvrtl.tmp в %ProgramFiles(x86)%\nres\themes\cirecle_flare.png
- %ProgramFiles(x86)%\nres\themes\is-iu85r.tmp в %ProgramFiles(x86)%\nres\themes\circle_good_old.png
- %ProgramFiles(x86)%\nres\themes\is-vfe5b.tmp в %ProgramFiles(x86)%\nres\themes\circle_blick.png
- %ProgramFiles(x86)%\nres\themes\is-m7pvm.tmp в %ProgramFiles(x86)%\nres\themes\black_back.png
- %ProgramFiles(x86)%\nres\themes\is-aml6d.tmp в %ProgramFiles(x86)%\nres\themes\black.themeb
- %ProgramFiles(x86)%\nres\themes\is-bmsnd.tmp в %ProgramFiles(x86)%\nres\themes\back_good_to_go.png
- %ProgramFiles(x86)%\nres\tweaks\is-303ed.tmp в %ProgramFiles(x86)%\nres\tweaks\tweaksdb.nat
- %ProgramFiles(x86)%\nres\themes\is-bjnor.tmp в %ProgramFiles(x86)%\nres\themes\cosmos.themeb
- %ProgramFiles(x86)%\nres\is-3q0r3.tmp в %ProgramFiles(x86)%\nres\servman-log.txt
- %ProgramFiles(x86)%\nres\is-ja8rb.tmp в %ProgramFiles(x86)%\nres\readme.txt
- %ProgramFiles(x86)%\nres\is-sh1e1.tmp в %ProgramFiles(x86)%\nres\optimize.nat
- %ProgramFiles(x86)%\nres\is-u2tqk.tmp в %ProgramFiles(x86)%\nres\optimize.json
- %ProgramFiles(x86)%\nres\is-e7jd0.tmp в %ProgramFiles(x86)%\nres\license.txt
- %ProgramFiles(x86)%\nres\is-9pf1t.tmp в %ProgramFiles(x86)%\nres\hyperv.png
- %ProgramFiles(x86)%\nres\is-4g1so.tmp в %ProgramFiles(x86)%\nres\filesystem.png
- %ProgramFiles(x86)%\nres\is-de0sl.tmp в %ProgramFiles(x86)%\nres\unusedhardware.png
- %ProgramFiles(x86)%\nres\tweaks\is-gis8r.tmp в %ProgramFiles(x86)%\nres\tweaks\nc0060edgetweaks.png
- %ProgramFiles(x86)%\nres\themes\is-h1bqe.tmp в %ProgramFiles(x86)%\nres\themes\glow.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-hbiru.tmp в %ProgramFiles(x86)%\nres\themes\built-in\bubble.themeb
- %ProgramFiles(x86)%\nres\themes\is-06g3k.tmp в %ProgramFiles(x86)%\nres\themes\rings.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-batp8.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\chamomile.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-a5o1g.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\budapest.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-3hm17.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\bokeyellow.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-ns1u7.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\bokered.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-ba90r.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\boke.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\nature\is-q64l7.tmp в %ProgramFiles(x86)%\nres\themes\built-in\nature\bigmountains.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-5ednq.tmp в %ProgramFiles(x86)%\nres\themes\built-in\black.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\funny\is-2piui.tmp в %ProgramFiles(x86)%\nres\themes\built-in\funny\penguine.themeb
- %ProgramFiles(x86)%\nres\themes\is-qquuv.tmp в %ProgramFiles(x86)%\nres\themes\classic.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-08val.tmp в %ProgramFiles(x86)%\nres\themes\built-in\spinner.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-j01p1.tmp в %ProgramFiles(x86)%\nres\themes\built-in\rings.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-qb17c.tmp в %ProgramFiles(x86)%\nres\themes\built-in\glow.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-sh1rs.tmp в %ProgramFiles(x86)%\nres\themes\built-in\daynight.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-eaif1.tmp в %ProgramFiles(x86)%\nres\themes\built-in\cosmos.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-9g9ct.tmp в %ProgramFiles(x86)%\nres\themes\built-in\classic.themeb
- %ProgramFiles(x86)%\nres\themes\built-in\is-kvn7s.tmp в %ProgramFiles(x86)%\nres\themes\built-in\water.themeb
- %ProgramFiles(x86)%\nres\is-374v0.tmp в %ProgramFiles(x86)%\nres\nres917.exe
Сетевая активность
Подключается к
- 'mi####njobs.works':80
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######
Запросы HTTP POST
- http://mi####njobs.works/new/net_api
UDP
- DNS ASK mi####njobs.works
Другое
Ищет следующие окна
- ClassName: 'j23e49_nres917Class_j23e49' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-7klql.tmp\is-spoc6.tmp' /SL4 $B017A "<Полный путь к файлу>" 3937497 52224
- '%ProgramFiles(x86)%\nres\nres917.exe'
- '%ProgramFiles(x86)%\nres\nres917.exe' 62e0bd53457d6cd9f6781a2c080506a4
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' helpmsg 17
- '%WINDIR%\syswow64\net1.exe' helpmsg 17
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "NRES-917"
